December 2014 - keycloak-user - Jboss List Archives

by Alexander Chriztopher

Hi, We are using Keycloak with all its data persisted to an Oracle database. Actually, when we disable the caches for realm and user then save and reboot our server we find that the cache is enabled again ! Is this a normal behaviour or a bug ?

11 years

2
2
0 / 0

Hacking on Keycloak

by Stan Silvert

I've created a Wiki to show it's not tricky, To start working with our fine code. It's short and it's sweet, and it's not quite complete, But for now it is all that I showed. https://github.com/keycloak/keycloak/wiki/Hacking-on-Keycloak Feel free to add your own tips to this page. Just refrain from poor verse like above.

11 years

2
1
0 / 0

Key Cloak Support

by Luke_Adams＠ao.uscourts.gov

11 years

3
2
0 / 0

Protecting Hadoop UIs with Keycloak?

by Kevin Minder

Hi Keycloak, I'm interested in putting together a quick POC of Keycloak as the SSO server for several Hadoop UIs. Most Hadoop UIs use an embedded Jetty server and they provide a Hadoop specific authentication plugin mechanism. See: https://github.com/apache/hadoop/blob/trunk/hadoop-common-project/hadoop-... I was hoping to find in docs or in an example on the web a non-container managed servlet filter integration that I could rework into a Hadoop AuthenticationHandler. Anyway, would I be on the right track if I... 1) Wrap the adapters below in Hadoop AuthenticationHandlers having AuthenticationHandler.authenticate call *Authenticator.authenticate keycloak/integration/adapter-core/src/main/java/org/keycloak/adapters/BasicAuthRequestAuthenticator.java keycloak/integration/adapter-core/src/main/java/org/keycloak/adapters/BearerTokenRequestAuthenticator.java 2) In those, wrap the request/response in this keycloak/integration/jetty/jetty-core/src/main/java/org/keycloak/adapters/jetty/JettyHttpFacade.java 3) Create the KeycloakDeployment via the builder with these with a keystone.js input stream from somewhere keycloak/integration/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java keycloak/integration/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeploymentBuilder.java What totally obvious things am I missing? Is it possible to have a container agnostic integration like this? For one I'm not seeing how the KeycloakSecurityContext attribute that JettyHttpFacade expects is setup in the Jetty adapter. Kevin. -- CONFIDENTIALITY NOTICE NOTICE: This message is intended for the use of the individual or entity to which it is addressed and may contain information that is confidential, privileged and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any printing, copying, dissemination, distribution, disclosure or forwarding of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and delete it from your system. Thank You.

11 years

2
1
0 / 0

Questions about keycloak

by Ruben Lopez

Hi, Our organization is currently evaluating the use of Keycloak and we have some questions: 1 - Is there any way to obtain an access token for an OAuth Client via Client Credentials[1]? 2 - If we make a request to an Application (Resource Server) with an access token and this Application needs to talk to another protected Application to form the response to the client, how does the first Application authenticates to the second Application? Does Keycloak implements something like Chain Grant Type Profile[2]? Thanks in advance.

11 years

3
8
0 / 0

HTML5/JS and download URL.

by Jérôme Blanchard

Hi all, We have a use case where an HTML5/Angular application is calling a REST interface using keycloak for authentication SSO. Everything works fine until we need to download files or preview images (using <img> tag). In both case, this is the browser which perform the request on the REST url and, because of a specific XHR authentication putting the bearer token in the headers, a 'classic' browser request for downloading a file result in an UNauthenticated request because of unexisting bearer token. We're minding if there is a best practice to handle this case. We plan to include a dedicated token as a download request parameter and to check this particular query paramter programmatically in the /download JAX-RS operation. What kind of token should have to put in the query and is there an already existing mechanism to catch such token in jax-rs server-side operations nor programmatically ? Thanks a lot for your support and so good work, Best Regards, Jérôme.

11 years

2
3
0 / 0

IE9 compatibility

by Nils Preusker

Hi all, we are currently in the process of going live with a web application that uses keycloak. During our initial tests we encountered and fixed some issues with Internet Explorer 9. Since the changes we applied don't require any API changes and only address the way keycloak.js communicates with the embedded login status iframe (login-status-iframe.html), we'd love to see a 1.0.5.Final release with our patch (see attachment). In addition to the patch, we added the following HTML5 cross browser polyfills: * https://github.com/davidchambers/Base64.js * https://github.com/devote/HTML5-History-API Let me know if you have any additional questions! Cheers, Nils

11 years

2
5
0 / 0

1.1 Beta2 in Wildfly cluster

by Schneider, John DODGE CONSULTING SERVICES, LLC

Hi, Correction, I *thought* everything was running in Wildfly domain mode. It turns out I just got lucky by hitting the same server node in my initial test. After a reboot and further testing today, I’m not able to login to the Keycloak admin console when both nodes in my cluster are running. After attempting login, I am either taken back to a blank login page, or I see error “Unknown code, please login again through your application.” Once in awhile, I can login without error. I should note that I’m using an Apache reverse proxy via mod_cluster. I see no errors in the server logs. I do see message “JBAS010281: Started <x> cache from keycloak container” for each of “realms”, “sessions”, “loginFailures”, “users”. So, it looks like my domain config is working. However, I can’t tell for sure that Keycloak is attempting to use the infinispan caches. Some additional log output showing the values from keycloak-server.json would be helpful. I used the CLI to upload “/profile=full-ha/subsystem=keycloak/auth-server=keycloak-1/:update-server-config(bytes-to-upload=/usr/local/wildfly/domain/configuration/keycloak-server.json~,overwrite=true)” The response was “success” and then I restarted Wildfly on both nodes in the cluster. Has anyone been able to get Keycloak 1.1 Beta 2 working in a wildfly domain, and using mod_cluster? If so, could you please provide guidance? Thanks, John From: Schneider, John DODGE CONSULTING SERVICES, LLC Sent: Monday, December 08, 2014 6:43 PM To: keycloak-user(a)lists.jboss.org Subject: 1.1 documentation update for running in domain HA mode Hi guys, Thanks so much for getting clustering support working in 1.1. I have it up and running well in a Wildfly 8 domain setup under the “full-ha” profile. One thing that I was pulling my hair out about for a while today were some errors related to Infinispan config. I figured out that if running in HA cluster, you must include the “transport” element under the cache-container config (i.e. <transport lock-timeout=”60000” />). It would be great if you could update Chapter 23 of the documentation to reflect this requirement. Thanks, John

11 years

2
4
0 / 0

How to get an access code via rest service

by Michael Gerber

Hi, I've got a fat client and a web application. My client wants to get an access code to open a new browser with these access code as URL parameter, so the users are directly logged in without reentering their credentials. Thank you for your help! kind regards Michael

11 years

2
1
0 / 0

Sub-resource authentication (edge case)

by Eric Wittmann

In apiman I have a bit of an edge case that currently isn't working as I was hoping (running in wildfly 8.2 - not tested on any other platform). The issue is that I have a WAR with two sub-contexts: /api - JAX-RS endpoints to configure the API Gateway /gateway - the API Gateway (reverse proxy) I wanted /api to be protected by keycloak, but for /gateway to be unprotected. My web.xml looks like this: <security-constraint> <web-resource-collection> <web-resource-name>apiman-gateway</web-resource-name> <url-pattern>/api/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>apiadmin</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>apiman</realm-name> </login-config> <security-role> <role-name>apiadmin</role-name> </security-role> It all works great until I send a request to /gateway/* that includes an "Authorization" http header. If I do that, the adapter tries to authenticate with those credentials and fails with a 401 if they don't match (which they don't). I realize this is an odd case, but I did expect that if the web.xml specified that only /api/* were protected then other paths would simply pass through any Authorization headers. That may be an incorrect expectation - not sure what the servlet spec requires in this case. Thoughts? Currently I'm probably going to work around this by splitting up the API and Gateway servlets into separate WARs. -Eric

11 years

3
3
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user December 2014